Editing Bugs & Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 1: | Line 1: | ||
== Unknown / unpatched == | == Unknown / unpatched == | ||
=== | === Remote DoS Exploit === | ||
http://cxsecurity.com/issue/WLB-2007030183 | |||
Patched: ? | |||
Patched | |||
=== Memory corruption and NULL pointer in Unreal Tournament III 1.2 === | === Memory corruption and NULL pointer in Unreal Tournament III 1.2 === | ||
http://cxsecurity.com/issue/WLB-2008070060 | |||
unsure if applies to PS3? | |||
=== MacOS X 10.5/10.6 libc/strtod(3) buffer overflow === | === MacOS X 10.5/10.6 libc/strtod(3) buffer overflow === | ||
http://cxsecurity.com/issue/WLB-2010010162 | |||
unsure if applies to PS3? | |||
=== OpenPrinter() stack-based buffer overflow === | === OpenPrinter() stack-based buffer overflow === | ||
http://seclists.org/fulldisclosure/2007/Jan/474 | |||
Patched: ? | |||
=== DOM flaw === | === DOM flaw === | ||
http://seclists.org/fulldisclosure/2009/Jul/299 | http://seclists.org/fulldisclosure/2009/Jul/299 | ||
Patched: ? | |||
== Patched == | == Patched == | ||
=== RSX Syscall bug === | === RSX Syscall bug === | ||
In most syscalls sony reduces a pointer to 32 bits and would use a special function to write to that pointer.<br> however, in certain rsx syscalls, sony forgot about it, allowing the attacker to write to any part of lv2 memory. | In most syscalls sony reduces a pointer to 32 bits and would use a special function to write to that pointer.<br> however, in certain rsx syscalls, sony forgot about it, allowing the attacker to write to any part of lv2 memory. | ||
Patched: [[4. | Patched: [[4.45_CEX|4.45]] | ||
=== CTR bugs on SELFs (and ebootroms maybe?) === | |||
http://crypto.stackexchange.com/questions/14628/why-do-we-use-xts-over-ctr-for-disk-encryption CTR bugs on SELFs | |||
Patched: since Vita pre-retail [http://www.vitadevwiki.com/index.php?title=00.996.090_DEX 0.9.9.6] (SELFs, should match with ps3 firmware at release date), unknown (ebootroms) | |||
=== PARAM.SFO stack-based buffer overflow === | === PARAM.SFO stack-based buffer overflow === | ||
http://seclists.org/fulldisclosure/2013/May/113 | |||
Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later) | Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later) | ||
| Line 153: | Line 45: | ||
==== Proof of Concept ==== | ==== Proof of Concept ==== | ||
Unsigned code can be added to the [[PARAM.SFO]] because the console does not recognize special characters | Unsigned code can be added to the [[PARAM.SFO]] because the console does not recognize special characters | ||
http://www.exploit-db.com/exploits/25718/ | |||
Working on [[4.31_CEX|4.31]] | Working on [[4.31_CEX|4.31]], Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later) | ||
PoC: PARAM.SFO | PoC: PARAM.SFO | ||
| Line 186: | Line 78: | ||
=== AVP patch bypass exploit === | === AVP patch bypass exploit === | ||
Patched: since [[3.70_CEX|3.70]] and later | Patched: since [[3.70_CEX|3.70]] and later | ||
=== PSN security intrusion === | === PSN security intrusion === | ||
| Line 193: | Line 85: | ||
=== Sony PSN Account Service - Password Reset Vulnerability === | === Sony PSN Account Service - Password Reset Vulnerability === | ||
http://www.vulnerability-lab.com/get_content.php?id=740 | |||
Patched: since 2012-05-01 | Patched: since 2012-05-01 | ||
=== | === Private key nonrandom fail === | ||
Patched: since [[3.56-1 CEX|3.56]] | Patched: since [[3.56-1 CEX|3.56]] | ||
| Line 208: | Line 97: | ||
Patched: since [[3.56-1 CEX|3.56]] | Patched: since [[3.56-1 CEX|3.56]] | ||
=== USB config | === USB config stack-based buffer overflow (PSjailbreak/PSGroove) === | ||
Patched: since [[3.42_CEX|3.42]] and later | Patched: since [[3.42_CEX|3.42]] and later | ||
| Line 232: | Line 121: | ||
Patched: since [[2.50_CEX|2.50]] and later | Patched: since [[2.50_CEX|2.50]] and later | ||
=== | === Downgrading with Hardware flasher === | ||
See also: [[Downgrading with Hardware flasher]] | |||
Patched: since [[2.20_CEX|2.20]] and later (by adding [[CoreOS]] hashing in [[Syscon Hardware|Syscon]] to be checked by [[Hypervisor Reverse Engineering|hypervisor]]; worked around by patching hypervisor on [[3.56-1 CEX|3.56]] and lower capable consoles) | |||
Patched: since [[2.20_CEX|2.20]] and later (by adding [[CoreOS]] hashing in [[Syscon Hardware|Syscon]] to be checked by [[Hypervisor Reverse Engineering|hypervisor]]; worked around by patching hypervisor on [[3.56-1 CEX|3.56]] and lower capable consoles) | |||
=== Full RSX access in OtherOS === | === Full RSX access in OtherOS === | ||
| Line 242: | Line 130: | ||
Patched: since [[2.10_CEX|2.10]] and later | Patched: since [[2.10_CEX|2.10]] and later | ||
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> | {{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude> | ||